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We present a class of fast quantum algorithms, based on 
Bernstein and Vazirani's parity problem, that retrieve the 
entire contents of a quantum database y in a single query. 
The class includes binary search problems and coin-weighing 
problems. Our methods far exceed the efficiency of classical 
algorithms which are bounded by the classical information- 
theoretic bound. We show the connection between classi- 
cal algorithms based on several compression codes and our 
quantum-mechanical method. 

PACS: 03.67.-a, 03.67.Lx, 89.70.-Fc 



I. INTRODUCTION 

Quantum computers have been shown recently to be 
able to solve certain problems faster than any known al- 
gorithm running on a classical computer [|]-^. These 
problems include factoring, which can be performed in 
polynomial time on a quantum computer but is 
widely believed to be exponentially difficult on a clas- 
sical computer, and database lookup, which is provably 
faster on a quantum computer |3|. Understanding the 
power of quantum algorithms and developing new algo- 
rithms is of major interest as the building of a quantum 
computer will require a huge investment. 

In this paper we present quantum algorithms for binary 
search and coin- weighing problems in which the informa- 
tion in a quantum database is retrieved with a single 
query. These are applications of Bernstein and Vazirani 
parity problem ||] and provide a strong illustration of the 
power of quantum computation and point out the limi- 
tations of classical information-theoretic bounds applied 
to quantum computers. 

Information theory is a useful tool for analyzing the 
efficiency of classical algorithms. Problems involving 
information retrieval from a database are particularly 
amenable to such analysis. Consider this database search 
problem: we have a database Y that contains n items, 
of which a single one is marked. This database is repre- 
sented as a bit string y of length n with Hamming weight 
one {y has exactly one "1"). One would like to locate the 



marked item in as few queries to the database as possi- 
ble. The queries are bit strings x of length n such that 
the database returns the answer 



a{x,y) 



X ■ y 



E 



mod 2 



(1.1) 



where Xi and yi are the i'^ bits of x and y. A simple 
version of this problem is the case in which the allowed 
queries x have Hamming weight 1. The information re- 
trieved by a single query Xj = Sij is small-it adds or 
eliminates item i from the set of possible marked items. 
It thus takes n — 1 queries to locate the marked item in 
the worst case. A surprising result of Grover |^ is that 
a quantum mechanical algorithm can be faster than this 
and find the marked item with high probability in 0{\/n) 
quantum queries, contrary to one's "classical" intuition. 
Grover's algorithm does not, however, violate the infor- 
mation theoretic lower bound on the minimal number of 
queries M. 

The information-theoretic lower bound Q on M is 
given by the amount of information in the database di- 
vided by the maximal amount of information retrieved 
by a query which has A possible answers, i.e. 



M > 



log2 A ' 



(1.2) 



where H{Y) = — J2yPv^'^S2Pvi Py the probability for 
Y to contain y and '^yPy — 1- 

A quantum algorithm employs a database which re- 
sponds to superpositions of queries with superpositions 
of answers. The quantum database acts on two input 
registers: register X containing the query state and 
register B, an output register of dimension A initially 
containing state \b). We define the operation of querying 
the database as 



Ry-. 



\x, b) \x, [6 -I- a{x, y)] mod A) 



(1.3) 



where Ry is a classical reversible transformation which 
maps basis states to basis states (that is, a permutation 
matrix) depending on the contents of the database, and 
a{x,y) is the answer to query x, given database state y. 
In a classical query only query basis states \x) are used 
and the output register B is initially set to |0). However, 
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a quantum database is not restricted to working only on 
basis states but can handle arbitrary superpositions of in- 
puts 01 . Because of this the information that is retrieved 
by a single quantum query is not bounded by logj A. The 
relevant quantity in the quantum setting is the accessi- 
ble information in the registers X and B (together called 
XB) and the internal state of the quantum computer $ 
about the database Y. Together these are always in a 
one of a set of pure states {\'4'y)jPv}v&Y and the accessi- 
ble information on y is bounded by the Kholevo bound 



hcc{<PXB) < S{<i>XB), 



(1.4) 



where S{^XB) = — Trp^xs log2 is the Von Neu- 

mann entropy of ^XB and p<s>xB = '^yPy\'^y){'^y\- In 
the case of a classical query, the Von Neumann entropy 
S{^XB) is strictly less than logo dim(i?) = log2 A which 
gives rise to the classical bound ( |l.2| ). The quantum algo- 
rithms that will be presented in this paper "violate" the 
classical information-theoretic bound by extracting extra 
information in the phases of the query register X . It is 
notable that Grover's Hamming weight one problem 
has been proven optimal no quantum algorithm 

for this problem can violate the classical information- 
theoretic bound (1.2). 

The quantum algorithms presented here are a ma- 
jor improvement on the classical algorithms in terms of 
computation time if the computation performed by the 
database is costly. All our algorithms make use of an in- 
teraction with the database of the form a(x, y) = x-y. A 
direct implementation of such a database takes 0{\ogn) 
time using n Toffoli and n XOR gates in parallel. The 
database can however be more general than this. Any 
function f{x) with the property that it can be written 
as f{x) —x-y can function as a database. The cir- 
cuit that computes f{x) for any input x € {0, 1}" runs 
in some time T{n). We will compare the running time 
of the quantum algorithms including this circuit to the 
classical running time. 



II. THE PARITY PROBLEM AND COIN 
WEIGHING 

Bernstein and Vazirani have given the first prob- 
lem in which a single quantum query to the database is 
sufficient and a strong violation of the classical informa- 
tion theoretic bound comes about. In their parity prob- 
lem they consider a database Y which contains an arbi- 
trary n-bit string y. The answer to queries represented 
by n-bit strings x to the database is the parity of the 
bits common to x and y given by a{x,y) = x ■ y. Note 
the the problem is to determine y in its entirety, not to 
merely determine the parity of y. Bernstein and Vazirani 
show that y can be determined in a single query to the 
database. Here we apply this quantum algorithm to the 
coin weighing problem. 



Coin weighing problems are a group of problems in 
which a set of defective coins is to be identified in a total 
set of coins. Assume there are two types of coins, good 
and bad ones, and we can weigh arbitrary sets of coins 
with a spring-scale ( which gives the weight of the set of 
coins directly, as opposed to a balance which compares 
two sets of coins). All sets of coins are equiprobable. A 
set of n coins is represented as a bit string y of length n 
where yi = 1 indicates that coin i is defective. A weighing 
can be represented by a query string x, where Xi specifies 
whether coin i is included in the set to be weighed. The 
result of a classical weighing is the Hamming weight of 
the bitwise product of x and y, wnix A y). For this 
problem the information theoretic bound (1.2) gives 



M > 



l0g2("+ 1) 



(2.1) 



This is close to what the best predetermined algorithm 
which perfectly identifies the set of coins can achieve M 



lim A'fprc(n) 



2n 



log2('^) 



(2.2) 



If one has a spring scale capable of performing weigh- 
ings in superposition, then, one can use the Bernstein- 
Vazirani algorithm to identify the defective coins per- 
fectly with a single weighing. 

Define n' = 2[^2±i"| _ i, We construct a query state 



1 1 " 

— y\x)(g> , y (-i)'i&) 



(2.3) 



The special preparation of register B will make the result 
of a quantum query end up in the phases of X while 
leaving register B itself unchanged (cf. [^). After the 
query we have (using (-l)™'-(^'^y) = {^ly-v) 



\^y 



n 

/=5:(-l)-|.)«-^^(-l)''|5). (2.4) 



h=0 



Thereafter we perform a Hadamard transform H on the 
query register 



This results in the final state 



(2.5) 



(2.6) 



thus retrieving y within a single query. 

Note that this coin-weighing algorithm uses only the 
parity of the Hamming weight of the answer whereas the 
full Hamming weight is available from the database and 
is fruitfully used in the classical algorithm. 
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We can compare the total running time of this quan- 
tum algorithm with that of the classical algorithm. The 
preprocessing and postprocessing of the register X of the 
query state and the preprocessing of the B register all 
consist of the Hadamard transforms on individual bits 



(2.7) 



which can be done in parallel. The total running time 
is then simply 2 + T{n). In the classical algori thm 
the database circuit is used at least (see Eq. 2.1 ) 
n/\og2{n + 1) times resulting in a total running time 
of at least nT{n)/\og2{n + 1). 



III. COMPRESSIVE ALGORITHMS 

In this section we will consider modifications of this 
problem in which the information in the database H{Y) 
is less than n bits. In these cases retrieving the data from 
the source can be viewed as a problem of data compres- 
sion of a source Y . We will restrict ourselves here to the 
compression of the data from a single use of the source. 
In the classical case, each query to the database retrieves 
a single digit of the word into which the bit string y will 
be encoded. The minimal set of predetermined classical 
queries will serve to construct the single quantum query 
algorithm. We will use coding schemes that minimize the 
amount of pre/postprocessing in the single query quan- 
tum algorithm. A classically optimal encoding scheme 
(cf. has 



H{Y)<Y,P^h<H{Y) + l, 



(3.1) 



where U the length of the compacted yi and pi the prob- 
ability that the database contains bit string yi. It is 
not guaranteed however that such an optimal encoding 
scheme can be implemented by the type of da tabase in- 
teraction that one is given to use, namely ( |l.5| ). 

In the following section we present single query quan- 
tum algorithms of which the construction is based on op- 
timal classical encoding schemes, namely Huffman cod- 
ing. In the section thereafter we consider more general 
type of databases and use a random coding scheme. Each 
of these schemes will require precomputation of a set of 
queries based on the encoding schemes. The time for 
this computation will not be counted in the total run- 
ning time as the queries can be precomputed once and 
reused on subsequent problems. 



A. Binary search problem 

Binary search problems are defined as problems in 
which the database responds with two answers to the 
query. Here we look at such a search problem in which 



the queries have Hamming weight n/2. The database 
contains a bit string y with Hamming weight 1. Let us 
first look at the problem in which all these bit strings are 
equiprobable. We assume that n is an integer power of 
two. For other n one simply extends the database size to 
the next higher power of two. 

Classically it is well known that the marked item can 
be found in log2 n queries, which achieves the classical 
information-theoretic bound ( |l.2| ). The fc"^ query, g^, is 
a string of 2*^"^ zeros alternating with a string of 2'^~^ 
ones, where k = 1 . . . log2 n, i.e. 



gi = 01010101.. 

32 = 00110011.. 

33 = 00001111.. 

etc. 

The result of query is 

Zk = gk-y = a{gk,y), 



(3.2) 



(3.3) 



where Zk is the fc*^ bit of the encoding z of y. Each 
y will have a different encoding z and thus z uniquely 
determines y. The gkS are the generators of the group 
F of Walsh functions whose group multiplication rule is 
addition modulo 2. We can represent a Walsh function 
fs as 



/s = ^ giSi mod 2, 



(3.4) 



where s is an arbitrary bit string of length log2 n. The 
quantum-mechanical algorithm makes use of superposi- 
tions of all the Walsh functions. We construct the query 
state 



|o) - |i) 

V2 ■ 



After one query the state becomes 

Vn, V2 
It can be shown that 

s 

We can write 

logan 

a{fs,y) = E ^ka{gk,y) mod 2. 
fc=i 



(3.5) 



(3.6) 



(3.7) 



(3.8) 



Using (3.3) it follows that a(/s,y) = s ■ z, and with this 
we can rewrite (pj) as 



Szz' 



(3.9) 
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As all states \il}y) and \ipy') are orthogonal, they can be 
distinguished by a measurement and no further queries 
to the database are required. 

What are the transformations that are required for pre- 
and postprocessing of the query? The preparation of the 
queries takes 1 + 7i/21og2 n steps. Register s is prepared 
in superposition using parallel one-bit Hadamard trans- 
forms and used as input to the circuit shown in Figure 
|l|. The circuit in Figure ^ uses multi-bit XORs which we 
have counted as being in series. The same sequence in 
reverse is used as the postprocessing. The total time 
is thus 2 -I- nlog2n -I- T{n). In the classical case the 
queries are also prepared using the circuit in Figure 
but the multi-bit XORs can be done in parallel, and the 



'logs 



Note that in the 



total time is (logj n)/2 + T(n] 
Cirac-Zoller ion-trap model of quantum computation 
a multi-bit XOR gate can be done in parallel by using the 
"bus phonon" modes. Such quantum computers run our 
algorithm in time 2 -I- logs + ^(")- 

Note that we could have used all possible queries as in 
section II to retrieve y and subsequently compacted y to 
z. This would have taken 2 + T(n) for the algorithm plus 
n log2 n steps for the compression, which is the same as 
this direct compression. 



FIG. 1. "Walsh" Circuit 

If we generalize this problem to databases that have 
unequal probabilities assigned to different y's, a scheme 
based on Huffman coding |]l2| is sometimes more efficient 
in terms of pre/post processing. We assume that the 
probability distribution, or HiY) is known beforehand. 

Huffman coding is a fixed-to-variable-length encoding 
of a source, in our case the database, which is optimal in 
the sense that it minimizes the average codeword length 
Y^iPih < HiY) -\- 1 with H(Y) the entropy of the source. 
The encoding prescribes a set of queries that play the role 



of the Walsh generators in the equal probabilities case. 
This is illustrated with an example in Figure ^ (In fact, 
the Huffman construction results in Walsh queries in the 
equal- probability-case.) 
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FIG. 2. Example of a Huffman code 

Classically, instead of querying with the Walsh genera- 
tors, one can use these Huffman queries, until the marked 
item has been found. The optimality of the Huffman code 
assures that the expected number of queries is minimized. 
Choose the set of queries that will take the place of the 
Walsh generators in the following way. Select a set of m 
queries, the first m queries that are used in the classical 
case, such that the probability of not finding the marked 
item after these m queries is very small. The value of m 
will depend on the probability distribution. If 



m < [log2 n\ , 



(3.10) 



n, the length of 
n] . If we choose 



this Huffman scheme can be more efficient than a Walsh 
scheme. 

Note that this requirement is not necessarily satisfied 
for all probability distributions. For example for the dis- 
tribution pi = 1/10, Pi = -^,1 = 1 ■ ■ • 
n—1 encoded words will be about [log2 
[logs n \ ~ s queries, the probability of error will be go to 
9/10 exponentially as 2~*. 

This set of m queries will take the place of the Walsh 
generators in our quantum algorithm. The circuit which 
implements the Huffman queries will be as in Fig. |l| 
but with a different pattern of XORs corresponding the 
Huffman queries. All the database states that gave rise 
to distinct codewords after these m classical queries will 
give rise to distinct \'ipy) in our quantum algorithm. 

If we query only once, the total running time will be 
2 + mn-\-T(ri) if we are willing to accept a small chance of 
error. A classical algorithm that uses the same Huffman 
queries and has the same probability of error takes m/2 + 
mT{n) time. Thus for some probability distributions, m 
can be significantly smaller than log2 n and the algorithm 
is faster than a straightforward search with the Walsh 
queries. 



B. Random coding 

The binary search and the coin weighing problem are 
special cases of a more general problem in which we have 
a database Y that contains k arbitrary base A strings of 
length n. Here we restrict ourselves to databases that 
contain k equally probable strings. 
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The queries x are all possible base A strings of length n, 
the elements of (Z^)". The database returns the answer 



a{x, y) = ^ XiUi mod A = 



X ■ y 



(3.11) 



The information H{Y) is equal to log^^ k. A classical pre- 
determined algorithm to determine y with high probabil- 
ity makes use of ni = log^ k + / random strings, where 
I is a small integer. Pick m linearly independent ran- 
dom base A strings of le ngth n; these are the queries t^i, 
i — \ . . .m. Similarly to (3^) we define the encoding as 



Zk ^ 9k-y 



(3.12) 



where Zk is the fc*^ digit of z. The QiS are used to com- 
press the string y of length n to the codewords z of length 
m. What is the probability that the codeword z de- 
termines y uniquely? The probability that two base A 
strings of length m are mapped onto the same codeword 
is equal to (^) . Thus, the probability of a collision 
with y is 



Pcol = 1 



-'1 



fe-i 



(3.13) 



For small 2 ' we approximate 



Pcol = 1-1 



fc-i 



2-'(l-l/fc) + 0(2-2') . 

(3.14) 



This probability can be made arbitrarily small for only 
a relatively small /. Thus 0(log^ k) random g^s are suf- 
ficient to retrieve the information with arbitrarily low 
probability of error. It is clear that for negative I the 
length of the codewords is not sufficiently large to avoid 
collisions. A codeword length of 0(log^ k) is thus neces- 
sary as well as sufficient. If the contents of the database 
are to be determined with certainty, the codeword length 
must be made larger. A code with no collisions and with 
codeword length 0(21og^/i;) always exists (cf. the dis- 
cussion of the birthday problem ||l5| ) . 

Our quantum algorithm to determine the contents of 
the database in a single query with high probability 
makes use of this classical random coding construction. 
The random strings gi, i = \ . . .m are the generators of 
a group Ca- The multiplication rule for this group is a 
digit-wise addition modulo A and the identity element is 
the string 0. Members of Ca can be written as 



c(s) ^Ca=> c{s)k = 22^9i)kSi mod A 



(3.15) 



with c{s)k the k^^ digit of a group element c(s) and s is a 
base A string of length m. Due to the linear independence 
of the generators, Ca is a subgroup of (Z^)" with A™ 
elements. 



For c(s) G Ca there is a on e-to-o ne map between c(s) 
and its encoding z defined in ( 3.12 ). This is true as 



Vi c e Ca, c • 5; = c = 



(3.16) 



which follows from the linear independence of the gener- 
ators. 

In the quantum algorithm we construct a state 
1^) = ^ E \s,cis))®^J2^A\b), (3.17) 
with OJA = . The query results in the state 



— y 



-a{c{s),y). 



c(s))^^^a;^|5). 



s\c{s)eCA 



(3.18) 



We can write, using the encoding z of y defined in (3.12) 
a{c{s),y) = s ■ z. (3.19) 

Thus we have 



{i^y\^y')^^Y^^l^'~''^^S..,. (3.20) 



If two different strings y and y' are mapped onto a dif- 
ferent codeword, they are thus distinguishable by a mea- 
surement. The probability that this occurs ( 3.14| ) can be 
made arbitrary small just as in the classical case since the 
encoding is the same. In order to measure, we reverse the 
preparation steps and then we perform a Fourier trans- 
form over (Zyi)" 



Ha: 



—y 



(3.21) 



A measurement in the query basis determines z and, with 
high probability, y. 

The circuit used to irnplcmcnt the random coding is 
similar to that in Figure but the XORS are replaced by 
summation base A operators. 



XORA(a, fe) = (a + h) mod A 



(3.22) 



and their locations are according to the random queries. 

The total quantum running time is 2 -I- mn -I- T{n). 
Here the basic unit of time is an operation on an A- 
dimensional Hilbert space. The classical time using the 
same random codewords is m/2 + mT{n). Since m is 
less than n, this algorithm is better than the direct coin- 
weighing algorithm provided we are willing to tolerate a 
small chance of error bounded by Pcoi- 



5 



IV. DISCUSSION 

We have discussed the complexity of our quantum al- 
gorithms compared to a classical setup and shown that 
the quantum algorithms are faster in situations in which 
T(n) > 0{n). In problems where querying the database 
would occur repeatedly, a bigger (real) separation be- 
tween the classical computation time and the quantum 
computation time could be achieved (see |^ for an in- 
stance of such a problem). 

It is noteworthy that in the binary search problem in 
the classical case only the generators of the Walsh func- 
tions are required, while the quantum algorithm needs all 
the Walsh functions to achieve this speedup. It would be 
interesting to find out whether any speedup is possible 
if the database only responds to queries which are the 
generators. 

We have chosen the quantum database Ry as defined 
in ( |l.3| ) to make a fair comparison with the classical set- 
ting. A unitary Uy could easily become more powerful 
as was pointed out in [ p^ . At its most general, a quan- 
tum database could be defined by an arbitrary unitary 
transformation acting on an input register and a hidden 
quantum state (the database). This has no good classical 
analogue and might be be worthwhile to explore. 
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and the Army Research Office and the Institute for Sci- 
entific Interchange, Italy, for financial support. B.M.T. 
would like to thank Bernard Nienhuis and Paul Vitanyi 
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